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n  this  note  demonstratqjythat  a  certain  class  of  naturally  occuring  prob¬ 
lems  involving  an  oracle  are  solvable  in  random  polynomial  time,  but  not  in 
deterministic  polynomial  time.  This  class  of  problems  is  especially  interesting 
because  a  very  slight  change  in  the  parameters  of  the  problem  yields  one  that 
does  have  a  polynomial  solution.  (  j  C  [}  j  C- _ 


1.  Introduction 

Recently  there  has  been  increased  interest  in  the  problem  of  interpolating  a  sparse 
polynomial  P  from  its  values.  Efficient  solutions  to  this  problem  can  be  used  to  sim¬ 
plify  many  multivariate  polynomial  calculations,  including  those  as  fundamental  as 
computing  the  greatest  common  divisor  of  two  polynomials.  An  essential  component 
of  determining  P  is  the  somewhat  simpler  of  problem  of  showing  that  P  is  not  the  zero 
polynomial.  In  this  paper  we  show  that  when  only  given  certain  information  about  P, 
no  deterministic  polynomial  time  algorithm  can  distinguish  P  from  the  zero  polyno¬ 
mial.  However,  there  do  exist  probabilistic  algorithms  that  distinguish  P  from  zero  in 
polynomial  time.  Since  proving  P  is  or  is  not  the  zero  polynomial  is  a  special  case  of 
determining  P,  these  results  imply  that  P  cannot  be  determined  in  deterministic  poly¬ 
nomial  time,  and  yet  there  exist  probabilistic  polynomial  algorithms  for  this  problem 
[8,9]. 

To  be  more  precise,  let  P{X |, . . . , Xn )  €  Z[X\,. . . , X„]  be  an  n  variable  polyno¬ 
mial  with  rational  integer  coefficients  and  let  Bp  be  a  black  box  that  represents  P.  Bp 
accepts  an  n-tuple  (aj,. . .  ,an)  6  Zn  and  returns  the  value  of  P(ai,. . .  ,an)  in  Z.  If  Bp 
ever  returns  a  non-zero  value  then  P  is  not  the  zero  polynomial.  The  zero  equivalence 
problem  for  P  is  to  provide  an  algorithm  for  generating  n-tuples  such  that  if  P  vanishes 
at  each  of  the  n-tuples,  it  is  the  zero  polynomial. 

To  make  this  problem  solvable  bounds  are  needed  that  characterize  the  size  of  P. 
We  are  interested  in  algorithms  whose  time  requirements  are  polynomial  in  terms  of 
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these  bounds.  The  most  direct  approach  is  to  give  bounds  on  the  degrees  of  the  X{  in 
P.  We  call  this  the  zero  equivalence  problem  with  degree  bounds.  This  problem  was 
shown  to  be  solvable  in  probabilistic  polynomial  time  simultaneously  by  Schwartz  [8] 
and  Zippel  [9]  in  1979.  Here,  we  show  that  this  problem  has  no  deterministic  polynomial 
time  solution. 

Alternatively,  we  might  be  given  a  bound  on  the  number  of  non-zero  terms  in  the 
polynomial  P  instead  of  the  degree  bound.  This  problem  is  called  the  zero  equivalence 
problem  with  term  bounds.  In  1987  ben  Or  and  Tiwari  [1]  and  Zippel  [10]  independently 
showed  that  this  problem  could  be  solved  in  deterministic  polynomial  time.  Other 
recent  work  on  this  problem  includes  [2,  4,  5]. 

To  minimize  the  number  of  subscripts  in  formulae  we  use  a  variant  of  Laurent 
Schwartz’s  notation.  Let  X  =  (Xi,  X2 , .  •  • ,  Xn )  and  e  =  (ej ,  e2, . . . ,  en)  be  two  vectors. 
Then  we  write  the  usual  (inner)  dot  product  as 


“'■c 


Co, 


V^rc 


Py 


I- 


Accesion  l-o' 


e  •  X  —  t\ X\  4-  e2X2  4*  •  •  •  +  enXn. 

We  also  extend  this  notation  to  exponentiation  as  follows 

X‘  =  (Xe\Xt3,...,Xen)  and  Xe  =  Xf'X?  •  •  •  Xenn. 
Thus  the  multivariate  polynomial 

Cl  X[“  X‘13  •  •  •  JC"  +  c2Xf3i  X\33  ■  ■  •  X +  ■■■  +  ctXf'X?*  •  •  -  X‘‘ » 
will  be  written 

CiX *  +  c2X F*  +  •  •  •  +  ctXSt . 

The  vector  accent  is  always  given  when  this  notation  is  used. 
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Since  the  black  box  accepts  arguments  that  can  be  any  rational  integer,  we  need 
to  consider  the  time  Bp  requires  to  compute  its  values.  Otherwise,  we  might  be  able 
to  use  exceptionally  large  inputs  to  the  black  box  to  get  more  information  than  is 
justified.  If  the  inputs  to  the  black  box  are  integers  with  absolute  value  less  than  2W, 
the  time  required  for  an  evaluation  by  the  black  box  is  0(wr )  for  some  r.  If  the  black 
box  implements  a  straight  line  algorithm  and  uses  classical  integer  arithmetic,  r  =  2. 
If  fast  arithmetic  algorithms  are  used  r  =  1  +  e  for  small  e.  This  estimate  ignores  the 
complexity  of  the  computation  performed  by  Bp,  but  tries  to  take  into  account  the 
growth  in  time  required  by  larger  inputs. 


2.  Main  Results 

The  key  observation  in  this  paper  is  that  it  is  easy  to  find  non-zero  polynomials 
that  vanish  at  many  points.  This  is  shown  in  the  following  proposition. 


Proposition  1.  Let  D,  T  and  n  be  integers  such  that  Dn  >  T.  Let  S  =  {a*}  be  a 
set  ofT  —  1  n-tuples.  There  exists  a  polynomial  with  rational  integer  coefficients  with 
no  more  than  T  non-zero  monomials  and  that  vanishes  at  each  point  in  S. 
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Proof:  In  fact,  there  are  many  polynomials  that  satisfy  the  requirements.  Choose  a 
set  of  T  distinct  n- tuples,  ei , . . . ,  er •  There  exists  a  polynomial  with  these  n-tuples  as 
exponents  that  vanishes  at  every  point  in  S. 

Let  P{X)  be  a  polynomial  whose  monomials  have  t\ , . . . ,  eV  as  exponent  vectors: 

P(X)  =  cxX *  4-  c2X*3  +  •  •  •  +  ctX*t. 

The  coefficients  (cj)  will  be  determined  from  S.  For  P  to  vanish  at  a,  6  S  the  cj  must 
satisfy  the  following  linear  equation: 

Cjo^1  +  c2a%3  4-  •  •  •  4-  ct<%t  =  0. 

vanishes  at  each  element  of  S  if  the  Cj  satisfy  the  following  system  of  linear 

Claf'  +  c2af3  4 - 4-  ct^t  —  0 

City  4-  c2a^3  4~  •  •  •  4-  CT<f2T  —  0 

CiOy  4-  c2a^p  4-  •  •  •  4-  cto^  =  0 

Since  these  equations  are  homogenous  and  there  are  more  variables  than  equations,  the 
system  possesses  a  non-trivial  solution.  Q 

Proposition  1  directly  implies  the  non-existence  of  a  deterministic  algorithm  for 
zero  recognition. 

Proposition  2.  Given  a  black  box  representing  a  polynomial  P(X)  in  n  variables  and 
of  degree  less  than  D  in  each  variable,  any  deterministic  algorithm  the  determines  if  P 
is  the  zero  polynomial  runs  in  time  at  least  0(Dn  Iogr  D). 

Proof:  The  time  required  by  the  algorithm  is  at  least  as  large  the  number  of  trial 
evaluations  used.  Since  no  polynomial  of  degree  less  than  D  has  more  than  Dn  terms, 
Dn  trials  suffice.  Thus  the  problem  can  be  solved  in  exponential  time.  By  proposition 
1,  if  the  algorithm  uses  less  than  Dn  trials  there  will  be  polynomials  that  meet  the 
degree  bounds  and  that  are  indistinguishable  from  the  zero  polynomial.  Thus  at  least 
Dn  trial  evaluations  are  required. 

Since  each  of  these  trial  points  must  be  distinct,  the  components  must  be  chosen 
from  a  set  of  at  least  D  elements.  Thus  Bp  will  require  0(logr  D)  time  for  each  trial, 
and  any  deterministic  algorithm  will  need  at  least  0(Dn  logr  D )  time.  Q 

Though  the  zero  equivalence  problem,  given  degree  bounds,  is  not  solvable  in 
deterministic  polynomial  time,  notice  that  a  polynomial  that  vanishes  at  each  of  0(Dn ) 
trial  points,  constructed  as  in  the  proof  of  proposition  2  would  have  0(Dn)  non-zero 
terms.  It  would  be  very  interesting  to  know  if  there  exists  a  polynomial  that  vanishes 
at  those  trial  points  and  that  has  a  more  succint  representation  (straight-line  program, 
for  instance). 

Probabilistic  algorithms  for  the  zero  equivalence  problem  were  initially  introduced 
by  Schwartz  [8j  and  Zippel  [9].  These  algorithms  require  a  random  number  generator. 


Thus  P(X) 
equations. 
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Given  an  e,  this  algorithm  shows  that  P  is  zero  with  probability  less  than  e,  averaged 
across  random  number  generators  with  normal  distributions.  Such  a  probabilistic  al¬ 
gorithm  solves  a  problem  in  polynomial  time  if  the  time  required  is  polynomial  in  the 
inputs  and  polynomial  in  e~1. 

The  probabilistic  algorithms  are  based  on  the  following  proposition  proved  in  [9, 
10],  where  it  is  also  shown  to  be  the  best  possible  result.  The  slightly  weaker  result  of 
the  last  line  of  the  proposition  appears  and  is  used  in  the  work  of  Schwartz  [8]. 

Proposition  3.  Let  k  be  a  field,  /  €  k[X \ , . . . ,  Xn]  and  the  degree  of  f  in  each  of  X, 
be  bounded  by  d j.  Let  Zn(B)  be  the  number  of  zeroes  of  f,  x  such  that  X{  is  chosen 
from  a  set  with  B  elements,  B  d.  Then 


Z„(B)  <  Bn  -  (B  -  d\  )(B  -  d2)  -  •  •  (B  -  dn) 

«0((d1+d2  +  ---  +  dn)Bn"1). 

This  proposition  immediately  gives  a  probabilistic  algorithm  for  zero  equivalence. 
We  only  indicate  that  a  polynomial  is  non-zero  when  Bp  returns  a  non- zero  value, 
proving  that  P  is  non-zero.  We  want  to  know  the  probability  that  Bp  returns  zero 
even  though  P  is  not  identically  zero.  Assume  that  P  is  not  the  zero  polynomial. 
Define  the  set  Sb  to  be 

Sb  =  {(xi,...,zn)|0  <  Xi  <  B}. 

Let  x  be  an  element  of  Sb  such  that  Bp  returns  zero.  Then  x  is  one  of  the  at  most 
Zn(B )  zeroes  in  of  P  in  Sb-  If  we  choose  x  randomly,  the  probability  that  we  will  get 
a  zero  of  P(X)  is  (by  proposition  3) 

Zn(B )  ^  (dj  +  d2  +  •  •  •  -f  d„)  _  nD 

Bn  “  B  B  ’ 

where  the  D  >  max(d,).  The  probability  that  k  randomly  chosen  elements  of  Sb 
would  both  yield  a  value  of  zero  (even  though  P  is  not  the  zero  polynomial)  is  less  than 
( nD/B)k . 

To  verify  that  a  polynomial  P(X i, . . . , Xn),  whose  degree  in  each  variable  is  less 
than  D,  is  zero  with  probability  less  than  e  we  need  to  perform  k  evaluations  with 
random  elements  of  Sb  where 


A  single  evaluation  will  suffice  if  B  is  chosen  such  that  B  >  nD/e.  The  cost  of  the 
single  evaluation  is  the  cost  of  the  black  box  evaluation.  Recall  that  the  cost  of  a  black 
box  evaluation  with  n-tuple  components  of  size  w  is  0(wr),  for  some  r.  Since  the  size 
of  the  components  of  the  random  n-tuple  is  log  nD/e,  the  cost  of  a  single  evaluation  is 
O(logr  nD/e).  If  k  different  evaluations  are  used,  then  we  need  to  choose  B  such  that 
(1)  is  satisfied.  So, 

logB  <  lognD  +  -  log 
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The  cost  of  a  single  evaluation  when  k  are  intended  is 


and  the  total  time  required  for  k  evaluations  using  the  probabilistic  approach  will  be 


Cprob  —  0 


This  quantity  is  minimized  when 


(r  —  1)  log  ~ 
log  nD  ' 

Since  1/e  >■  nD ,  using  multiple  evaluations  with  relatively  small  evaluation  points  is 
better  than  a  single  evaluation  at  a  large  evaluation  point. 

Replacing  k  by  this  quantity  in  Cptop  we  have 


Cprob  —  0 


(  (r~ 

log  nD 


logr  nD 


=°(SIogr(nI>),+7iT) 

=  0(log  i  x  log"'1  nD). 


Notice  that  the  cost  of  the  probabilistic  algorithm  is  linear  in  the  logarithm  of  of 
the  error.  This,  I  feel,  is  a  good  characterization  of  what  it  means  for  a  probabilistic 
algorithm  to  be  polynomial  time. 

There  is  a  slight  variant  of  the  zero  equivalence  problem  that  can  be  solved  in 
deterministic  polynomial  time.  Instead  of  being  given  degree  bounds  for  the  polynomial, 
we  are  given  a  bound  on  the  number  of  non-zero  monomials  in  the  polynomial.  We  call 
this  problem  the  zero  equivalence  problem  with  term  boxmds. 

The  following  proposition  and  the  algorithm  based  on  it  are  due  to  Gregoriev  and 
Karpinski  [3]. 

Proposition  4.  (Grigoriev  and  Karpinski)  Let  P{X )  €  Z[Xi, . . .  ,X„]  and  assume 
that  P  has  no  more  than  T  monomials.  Then  there  exists  a  set  ofT  n-tuples  such  that 
P  either  is  different  from  zero  at  one  of  them  or  P  is  identically  zero. 


Proof:  Write  P  as 

P(J?)  =  aiXe"‘  +.-.  +  aTXST, 
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where  some  of  the  a,  may  be  zero.  If  we  evaluate  P  at  (2, 3, 5, . . .  ,p„)  (where  pn  is  the 
n-th  prime)  we  will  have 

P(  2, 3, . . .  ,p„)  =  ai(2, 3, . . .  ,pn)*  +  a2(2, 3, . . .  ,p„)e~’  +  •  •  •  +  aT(  2, 3,...  ,Pnfr 
=  airrti  +  a2m2  - +  armr, 


where  the  m*  are  dstinct  because  of  unique  factorization.  Using  tk  =  (2*,  3*, . . .  ,p£) 
as  our  evaluation  points, 


P(tk)  =  aim*  +  a2m*  -| - h  a^m^. 


If  P  is  zero  at  each  of  <o, . . .  ,<r-i,  then  the  coefficients  of  P,  a,,  will  satisfy  the 
following  system  of  linear  equations: 


ai  4-  a2  +  •  *  *  olt  ~  0 
dim]  4-  a2m2  4*  •  •  •  4-  a.j'Tnj'  —  0 
aim*  +  a2mj  H - +  ar^r  ~  0 


T —  1  j  T—  1  I  I  T—  1  a 

OitTij  +  d2^2  +  •  •  *  +  a,TmT  —  U 

This  is  a  Vandermonde  system  and  is  nonsingular  since  each  of  the  are  different. 
Thus  each  either  all  of  the  a{  are  zero  or  P  is  different  from  zero  and  will  not  vanish 
at  one  of  U.  Q 

A  deterministic  solution  of  the  zero  equivalence  problem  with  term  bounds  follows 
from  proposition  4  easily.  We  pass  the  trial  points  <o»  •  •  • ,  ^t-\  to  Bp.  If  Bp  returns 
an  answer  different  from  zero  for  any  of  the  t,-  then  P  is  not  the  zero  polynomial. 
If  Bp  returns  zero  for  all  of  the  trial  points  then  P  is  the  zero  polynomial.  This 
algorithm  requires  T  evaluations  using  Bp,  the  last  of  which  will  involve  numbers  as 
large  p^_1.  The  n-th  prime  is  approximately  n  log  n.  So  the  fc-th  evaluation  by  Bp  will 
require  O ((k log(n log n))r)  time,  which  we  approximate  by  O((fclogn)r).  Thus  all  T 
evaluations  require 


T-i 

22  0((k  log  n)r)  =  0(Tr+1r"1  logr  n)  =  0(Tr+1  logr  n) 
k= 0 


time. 

3.  Discussion 

The  results  of  the  previous  section  are  summarized  in  the  following  table.  The 
columns  correspond  to  probabilistic  and  deterministic  algorithms  respectively.  The 
rows  correspond  to  whether  degree  bounds  or  term  bounds  are  given.  In  the  determin¬ 
istic,  bounded  degree  case,  we  have  given  a  lower  bound  on  the  time  required,  while 
for  the  other  two  entries  we  have  demonstrated  algorithms  that  achieve  the  indicated 


Draft  of  13:48  Feb  1,  1989 


6 


performance.  Also  recall  that  r  is  a  constant  corresponding  to  the  type  of  arithmetic 
being  used  by  Bp.  For  classical  arithmetic  r  =  2;  for  fast  arithmetic  r  is  slightly  greater 
than  1. 


_ I  Probabilistic _ [ 

degree  bounds  |  log  i  x  logr_1  nD 

term  bounds  S  ! 


Deterministic 
Dn  logr  D 
T’  ‘ 1  logr  n 


As  remarked  earlier,  the  zero  equivalence  problem  with  degree  bounds  cannot  be 
solved  in  deterministic  polynomial  time,  yet  it  can  be  solved  in  probabilistic  polyno¬ 
mial  time.  We  find  it  very  curious  that  with  a  slight  change  to  the  way  information 
is  provided,  the  problem  can  be  solved  in  determinstic  polynomial  time.  The  zero 
equivalence  problem  seems  lies  on  the  boundary  between  those  problems  that  can  and 
cannot  be  solved  in  deterministic  polynomial  time.  Though  earlier  work  has  shown 
that  random  and  deterministic  polynomial  time  can  be  separated  via  an  oracle  [6],  we 
find  this  example  interesting  because  it  arises  in  a  common  practical  problem. 

By  representing  the  polynomial  as  a  black  box,  we  have  swept  the  issues  of  the 
size  of  the  computation  required  to  compute  P(x)  under  the  rug.  If  we  could  look 
inside  Bp  and  examine  the  “program”  used  to  compute  P(x)  we  might  be  able  to 
show  that  Bp  represents  the  zero  polynomial  without  any  bounds  on  P.  For  example, 
it  seems  likely  that  one  can  deterministically  prove  that  a  straightline  program  for  a 
polynomial  (in  the  sense  of  Kaltofen  [7])  can  be  deterministically  shown  to  represent 
the  zero  polynomial  in  time  polynomial  in  the  size  of  the  straightline  program. 
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